Domain binding

When to use domain binding

• You need to prove that a business controls a specific domain.
• A counterparty needs machine-checkable evidence before signing, paying, or integrating.
• A platform requires a verifiable operator domain before listing.

Prerequisites

• An active parent ECZ-ID issued through TrustOps.
• DNS access for the target domain.
• A TrustOps-issued challenge value bound to your ECZ-ID.

Setup sequence

• TrustOps issues a backend-controlled challenge value for the target domain.
• You publish the challenge as a DNS TXT record and as a canonical well-known JSON file.
• Backend/Core observes both signals from its own infrastructure.
• Resolver projects BOUND only after Backend/Core has verified the control evidence.

DNS TXT record

Publish a TXT record at the _eczid subdomain. The challenge value is issued by TrustOps and bound to your ECZ-ID.

Record Type: TXT
Host: _eczid
Value:
ecz-id=ECZ-GB-XXXXXX; challenge=<backend-issued-challenge>; v=1

Canonical well-known path

The canonical well-known location is /.well-known/ecz-id.json. The legacy alias /.well-known/eczid.json may be supported where already deployed, but /.well-known/ecz-id.json is canonical for new deployments.

{
  "ecz_id": "ECZ-GB-XXXXXX",
  "binding_type": "domain",
  "issuer": "EcoCitizenz",
  "version": "1",
  "challenge": "<backend-issued-challenge>",
  "resolver": "https://resolver.ecocitizenz.org",
  "issued_at": "<timestamp>"
}

Setup artifact, not proof

Verification states

Resolver may report any of the following states for a domain binding. Only BOUND is operational proof.

Failure handling

• DNS not found — verify the _eczid TXT record is published and propagated; re-trigger observation in TrustOps.
• Challenge mismatch — re-issue from TrustOps and republish; old challenges never become valid retroactively.
• Stale challenge — challenges expire; the binding returns to CHALLENGE_ISSUED until a new value is observed.
• Domain moved — issue a new binding for the new domain; the old binding moves to REVOKED.

Privacy posture

• A domain may appear publicly in Resolver only after the binding reaches BOUND.
• Challenge values and temporary setup tokens are never standalone proof and are never published as such.
• Resolver does not expose internal infrastructure details.